Please do not open a public issue for security problems. Email Timothy.Gregg@complete.tech with the repository, a description of the issue, and steps to reproduce. If the repository has GitHub private vulnerability reporting enabled, you may use that instead.

We will acknowledge reports as soon as we reasonably can. This is a small research organization, so we make no guaranteed response times or bounty commitments.

Reports about code in this organization's repositories are in scope. Reports about upstream projects we have forked (for example llama.cpp) should go to the upstream maintainers.

If you find a credential or private hostname in any public repository here, report it by email as above rather than in an issue.